OneWebDesk

Email Deliverability Check

Check a domain's MX, SPF, DKIM, DMARC and blacklists at once.

Email Deliverability Check looks up a domain's MX, SPF and DMARC records at once and rates how likely your mail is to reach the inbox instead of the spam folder. Receiving servers like Gmail and Outlook only trust a domain when these core authentication records are in place.

Enter a domain and the tool shows whether MX (mail servers) exist, your SPF record and its policy (-all, ~all, etc.), and your DMARC policy (none/quarantine/reject), each flagged ok, warning or danger, plus an overall score and grade. DKIM is excluded here because it requires a selector — check it with DKIM Record Lookup. View individual records in detail with SPF Record Lookup and DMARC Record Lookup.

Why MX, SPF and DMARC must work together

To stop email spoofing, the three records act as a set. MX defines the servers that receive mail, SPF declares which IPs may send mail using your domain name, and DMARC tells receiving servers what to do (ignore, quarantine or reject) when SPF/DKIM checks fail. Leave any one out and attackers can impersonate your domain more easily, while legitimate mail is more likely to land in spam.

Reading policy strength

  • SPF -all: reject anything not listed (recommended). ~all is a soft fail (accept but mark), while ?all/+all offer little protection.
  • DMARC p=reject: reject failing mail (strongest). p=quarantine sends it to spam, and p=none only monitors without blocking.
  • If you are just starting, begin with p=none to collect reports, then ramp up to quarantine and finally reject once things look clean.

Score and grade

The tool weights MX presence, SPF presence and policy strength, and DMARC presence and policy strength into a 0–100 score with an A–F grade. A and B are healthy, C and D need work, and F means almost no protection. If your score is low, tighten the policies above and add DKIM as well. Also confirm your SPF stays within the 10-lookup limit using SPF Lookup Counter, and check whether your sending IP is listed with Email Blacklist (DNSBL) Check.

Frequently asked questions

Why isn't DKIM checked?
DKIM records live under a selector (e.g. google._domainkey) that differs per sending system, so they can't be found from the domain alone. If you know the selector, use a dedicated DKIM lookup tool.
Is SPF alone enough?
No. SPF only validates the sending IP; without DMARC, receivers have no instruction on how to handle failing mail. You need SPF, DKIM and DMARC together to effectively block spoofing.
My DMARC is p=none but it shows as risky.
p=none only monitors failing mail without blocking it, so protection is weak. Review the reports, then raise the policy to quarantine or reject to improve your score.
Can results differ from reality?
DNS caching and propagation mean a record you just changed may briefly show its old value. This tool also caches results for 60 seconds. The domain you enter is only queried against public resolvers — it is not stored or sent elsewhere.

Related tools

Email